fn check_policy(policy: &str) -> Result<()>Expand description
Every <action> in the policy must carry exactly one exec.path
annotation naming the fixed scxcli path, and there must be at least
one action. pkexec matches an action on that path, so an action
without one, or with another, is not covered by the contract.